masters

Creates, updates, deletes or gets a master resource or lists masters in a region

Overview

Name	masters
Type	Resource
Description	GuardDuty Master resource schema
Id	awscc.guardduty.masters

Fields

get (all properties)

Name	Datatype	Description
master_id	string	ID of the account used as the master account.
invitation_id	string	Value used to validate the master account to the member account.
detector_id	string	Unique ID of the detector of the GuardDuty member account.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
master_id	string	ID of the account used as the master account.
detector_id	string	Unique ID of the detector of the GuardDuty member account.
region	string	AWS region.

For more information, see AWS::GuardDuty::Master.

Methods

Name	Resource	Accessible by	Required Params
create_resource	masters	INSERT	MasterId, DetectorId, region
delete_resource	masters	DELETE	Identifier, region
list_resources	masters_list_only	SELECT	region
get_resource	masters	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual master.

SELECT
  region,
  master_id,
  invitation_id,
  detector_id
FROM awscc.guardduty.masters
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ detector_id }}|{{ master_id }}';

list (identifiers only)

Lists all masters in a region.

SELECT
  region,
  detector_id,
  master_id
FROM awscc.guardduty.masters_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new master resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.guardduty.masters (
  MasterId,
  DetectorId,
  region
)
SELECT
  '{{ master_id }}',
  '{{ detector_id }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.guardduty.masters (
  MasterId,
  InvitationId,
  DetectorId,
  region
)
SELECT
  '{{ master_id }}',
  '{{ invitation_id }}',
  '{{ detector_id }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: master
    props:
      - name: master_id
        value: '{{ master_id }}'
      - name: invitation_id
        value: '{{ invitation_id }}'
      - name: detector_id
        value: '{{ detector_id }}'

DELETE example

/*+ delete */
DELETE FROM awscc.guardduty.masters
WHERE
  Identifier = '{{ detector_id }}|{{ master_id }}' AND
  region = 'us-east-1';

Permissions

To operate on the masters resource, the following permissions are required:

Create

guardduty:ListInvitations,
guardduty:AcceptInvitation,
guardduty:GetMasterAccount

Read

guardduty:GetMasterAccount

Delete

guardduty:DisassociateFromMasterAccount

List

guardduty:GetMasterAccount